L2TP Client: FireBrick

FireBrick FB2500/FB2700/FB2900 Fully Loaded

The FireBrick can connect as an L2TP client for fallback and for its main connection. One thing to watch out for is making sure that the FB doesn't set its own gateway to be the tunnel (which would logically send tunnel packets up the tunnel, which is horrid). You can get around this by using separate routing tables.

This example is for L2TP being the main connection:

 <interface name="WAN"
            port="WAN1"
            table="1"
            comment="DHCP client">

 <l2tp>
  <outgoing name="AAISP"
            hostname="AAISP"
            server="l2tp.aa.net.uk"
            graph="AAISP"
            table="1"
            payload-table="0"
            username="example@a.1"
            password="secret"
            tcp-mss-fix="true"
            comment="L2TP tunnel to AAISP"/>
 </l2tp>

You can set to fall back to NAT if the tunnel is down. Traffic on routing table 0 won't have a default gateway if the L2TP is down, so will match this rule set that has target interface "nowhere":

 <rule-set name="Fallback"
           target-interface="nowhere"
           no-match-action="continue"
           comment="NAT fallback if can't establish L2TP">
  <rule name="NAT"
        set-nat="true"
        set-table="1"
        action="accept"/>
 </rule-set>

If the L2TP is being used for fallback, you are probably better off setting the routing table for the L2TP to something other than 0. Remember firewall rules only apply to single routing tables. You can then use profiles to bring the L2TP in to service in the even of the PPP going down etc.

Virgin Media

Some customers may be tunnelling into us via a Virgin Media connection (typically a Virgin Media router connected directly to the FB). Customers doing this may find that the tunnel can drop and not recover. You can resolve this by setting min-retry to 1. This is a hidden option, so you will need to click 'show all' under the tunnel settings.